The Director General of the Australian Signals Directorate used a speech at this week’s Sydney Dialogue to deliver a stark warning to Australian organisations about the risk of AI-enabled cyber attacks.
“We are sitting on, in Australia, an enormous legacy technology debt,” Abigail Bradshaw said.
“AI will either do one or the other: it’ll be a catalyst for decisions about replacing legacy technology; or, if we don’t move fast enough, almost certainly the legacy technology will be the first to be compromised in a major AI-enabled attack.”
“I think the most powerful thing – and meaningful thing – we can do is set some legacy technology reduction targets and to move towards those.”
One of Bradshaw’s key concerns revolved around a lack of knowledge concerning AI agents and their growing numbers.
“I think that prospect of getting some sort of definition or calculation of how these agents are out there is really remote,” Bradshaw said.
“And I would just say… A lot.”
Bradshaw’s warnings come as the entire AI ecosystem appears to be growing more and more alarmed at what it’s created, with calls for slowdowns with the technology coming from all the major partners, and in-the-know techbros warning of the need for AI killswitches.
Regardless, the warning over outdated tech has struck a chord with several local observers.
"The ASD's warning highlights a growing challenge for organisations that rely on ageing technology to support operations. As AI increases the speed and scale of cyber threats, older and end-of-life systems can become a source of cyber debt that is difficult to manage and increasingly costly to ignore,” said Quinton Kotze, Head of Cyber Solutions, Australia, at risk management firm Aon.
"Ageing technology should be viewed as a business resilience exposure, not simply an IT maintenance issue. Boards need visibility of these exposures and a clear plan to manage and reduce them over time.
"The choice is often between investing in modernisation today or accepting greater cyber risk in the future."
The need to upgrade, however, should not be viewed as an across-the-board problem, but rather as something requiring targeted effort, according to Kishore Jayaram, Chief Transformation Officer at Australian managed service provider Kinetic IT.
“For organisations responsible for critical services, it's about knowing your risk profile, which doesn't necessarily mean replacing every legacy system. It’s understanding which systems and dependencies carry the greatest consequence if compromised or disrupted, strengthening controls around them, and sequencing modernisation so security and resilience improve while essential services remain available,” Jayaram said.
“This becomes even more important as organisations introduce agentic AI. AI is increasingly becoming part of the operational fabric of an organisation, creating new dependencies across data, workflows, identity, platforms and controls. The ASD’s new guidance on agentic AI harnesses is important because it puts practical guardrails around those dependencies, from least-privilege access and secure design through to auditability, human oversight and clear accountability.”
Jayaram believes that these harnesses should be engineered from the ground up to ensure that a human is not just in the loop, but in control “so that accountability is never delegated”.
“The organisations that will make the greatest progress are those that can modernise and adopt AI while maintaining operational control and continuity as these dependencies evolve,” Jayaram said.
“For government and critical infrastructure, that ability to keep essential services running and trusted is ultimately what matters most.”
Want to see more stories from trusted news sources?Make Cyber Daily a preferred news source on Google.
